Falhas do tipo CWE-126

480 resultados

Leitura além dos limites do buffer em pilha

A aplicação lê dados além do tamanho alocado de um buffer armazenado na pilha (stack), acessando memória que não deveria. Diferente do overflow que escreve, aqui o problema é ler lixo de memória adjacente, expondo informações sensíveis ou causando crash se a memória for inacessível.

Exemplo

Uma função copia uma string para um buffer de 16 bytes, mas depois tenta processar 32 bytes do buffer sem validar o tamanho real. O código lê dados da pilha que pertencem a outras variáveis ou endereços de retorno, vazando informações ou provocando segfault.

Como mitigar

Sempre validar o tamanho dos dados antes de ler; usar funções seguras (strlen, strnlen) com limites explícitos; ativar canários de pilha (stack canaries) no compilador para detectar corrupção; fazer code review focado em loops e operações de memória sem bounds checking.

CVE-2023-49285HIGHDenial of Service in HTTP Message Processing in SquidEPSS 88.8%CVE-2017-7668—The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token()EPSS 57.5%CVE-2017-7679—In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious CoEPSS 39.3%CVE-2025-21277HIGHMicrosoft Message Queuing (MSMQ) Denial of Service VulnerabilityEPSS 37.8%CVE-2024-38071HIGHWindows Remote Desktop Licensing Service Denial of Service VulnerabilityEPSS 35.9%CVE-2009-2495MEDIUMThe Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 200EPSS 34.3%CVE-2024-20290HIGHA vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) EPSS 33.6%CVE-2023-38152MEDIUMDHCP Server Service Information Disclosure VulnerabilityEPSS 24.0%CVE-2023-36397CRITICALWindows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityEPSS 17.5%CVE-2024-26160MEDIUMWindows Cloud Files Mini Filter Driver Information Disclosure VulnerabilityEPSS 11.4%CVE-2019-11036MEDIUMHeap over-read in PHP EXIF extensionEPSS 7.0%CVE-2018-14790—Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA, FRENIC-Ace. A buffeEPSS 5.4%CVE-2023-38144HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 5.4%CVE-2018-8789—FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results in a Denial of ServicEPSS 5.2%CVE-2023-28266MEDIUMWindows Common Log File System Driver Information Disclosure VulnerabilityEPSS 4.4%CVE-2018-8799—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order() that results in a Denial ofEPSS 4.1%CVE-2018-8796—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_bitmap_updates() that results in a Denial of EPSS 4.1%CVE-2018-8792—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function cssp_read_tsrequest() that results in a Denial of SerEPSS 4.1%CVE-2018-8798—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() that results in an information EPSS 3.8%CVE-2018-8791—rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpdr_process() that results in an information leak.EPSS 3.8%